CVE-2026-62917

This is a SharePoint security bug where an attacker who already has a low-level account can trick the system into acting as if a request is coming from someone else. Think of it like forging the handwriting on a request slip—SharePoint may treat it as legitimate even though it shouldn’t.

This matters if your business runs Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server. The key requirement is that an attacker must already be an authorized user with low privileges, and user interaction is required. Because exploitation depends on having access inside your environment, the risk is highest when low-privilege accounts are reachable by attackers (for example, through compromised accounts) and the vulnerable behavior can be triggered.

This is RED because SharePoint spoofing can let a low-privileged, authenticated attacker impersonate requests, and a sophisticated threat actor (Lazarus group) is associated with the activity noted in the feed. Even though a fully public exploit isn’t shown in the findings, you should still treat this as urgent to reduce the chance of misuse from a compromised account. Patch promptly for all affected SharePoint builds.